Re: [secdir] [drinks] Secdir review of draft-ietf-drinks-spp-framework

[Paul Hoffman <[e-mail]>]

On Aug 23, 2012, at 9:36 AM, "Bhatia, Vikas" <[e-mail]> wrote:

> Agree with your point, but the line "SPPF is a protocol..." is not present in the current version of the framework draft (http://tools.ietf.org/html/draft-ietf-drinks-spp-framework-02) (assuming this line was taken from the document that was reviewed).

Correct. I was summarizing what SPPF was for the folks on the Secdir mailing list so they would have a bit of understanding of what was being protected.

> We will add a reference to the spp-protocol-over-soap document to the "Normative References" section in the framework document.

Thanks.

> Your point is valid. TLS is a MUST as mentioned in section 11.1 of the SOAP document (http://tools.ietf.org/html/draft-ietf-drinks-spp-protocol-over-soap-02). It seems to be an oversight to not have this requirement as a MUST in the framework. We shall replace existing text in the "Confidentiality and Integrity" section of the framework document as below:
> 
> "Any conforming transport protocol specification MUST provide means to protect the confidentiality and integrity of any data transmitted between SPPF client and server. "

Thanks.

--Paul Hoffman